diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index e4b7938..db86f47 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -17,7 +17,7 @@ permissions:
 
 env:
   GITLEAKS_VERSION: 8.30.1
-  # Rollout switch (ENG-523): "false" = credential findings warn but do not
+  # Rollout switch: "false" = credential findings warn but do not
   # fail the check. Flip to "true" once the fleet-wide rollout is triaged.
   # Lives here (not a workflow_call input) because required-workflow rulesets
   # trigger this workflow directly, with no caller to pass inputs.
@@ -130,7 +130,7 @@ jobs:
           set -e
           if [ "$status" -eq 2 ]; then
             count=$(jq length /tmp/internal-refs.json)
-            echo "::warning title=Internal references found::${count} internal Astera reference(s) in history. Fine for a private repo; MUST be resolved before making this repo public (see ENG-523 runbook)."
+            echo "::warning title=Internal references found::${count} internal Astera reference(s) in history. Fine for a private repo; MUST be resolved before making this repo public."
             {
               echo "## Internal references (warn-only): ${count} finding(s)"
               echo ""
diff --git a/README.md b/README.md
index e233562..fa9601b 100644
--- a/README.md
+++ b/README.md
@@ -13,3 +13,4 @@ appear as red informational checks and Slack alerts; they never block merges.
 This file is a vendored copy synced from
 `Astera-org/github-workflows/vendored/secret-scan-diffuse.yml`. Edit it there
 first, then copy it here.
+